THTLocker Ransomware

The THTLocker Ransomware is a Trojan that blocks your desktop with a pop-up and also may attempt to encrypt or delete local media, such as videos and pictures. Although the THTLocker Ransomware's campaign is targeting Russian speakers, its screen-locking function may block your access to programs or files, regardless of your IP address's implied geolocation or your system's language settings. Use any of the solutions described in this article for help with disabling and removing the THTLocker Ransomware safely.

The Bright Hue of Your Screen Locking You Outside

In the last, few days of September, malware researchers just became aware of a new, screen-locking threat. While the Trojan only has features for blocking the victim's monitor, its early stage of development implies that its threat actor may plan to add other futures, later, such as harmful encryption or ransom-themed messages. As usual, the new Trojan, THTLocker Ransomware, is a hazard for most PCs running the Windows operating system.

The THTLocker Ransomware's sole attack function that malware researchers can confirm as working is its 'screen-locker' feature. When running, the THTLocker Ransomware loads a maximized HTML window with an obfuscated border. The Trojan provides two messages, one in Russian, claiming to have affected your files, while the English one delivers a generic screen-locking alert in inexpert grammar. This stage of the THTLocker Ransomware's development doesn't display other, more advanced elements, such as timers, configurable fields for ransom-paying transactions, or specific demands for money.

Future builds of the THTLocker Ransomware may include other security risks. Malware researchers rate the most likely updates to the THTLocker Ransomware as follows:

• The THTLocker Ransomware may search your directories for files related to workplace data or recreational belongings, such as pictures, spreadsheets, or databases, and encrypt them using an algorithm, such as Rijndael. An encrypted file must be decrypted with a specialized code before it can open again in its associated programs.
• The THTLocker Ransomware also may establish a network connection to upload system information or to notify the threat actor about a successful attack. Some Trojans of the THTLocker Ransomware's category also include 'spyware' features that pass over passwords and similar, sensitive info.
• You also may find that backups, particularly Shadow Copy-related data, are deleted by the THTLocker Ransomware automatically.

Recoloring Your Monitor without a Con Artist's Assistance

A minority of security researchers investigating the THTLocker Ransomware are presuming it as being another variant of Hidden Tear's Onion3Cry Ransomware branch. The analyses of malware experts can't corroborate this conclusion, at this time, although a majority of security products are identifying the THTLocker Ransomware as a generic, file-locking threat. The versions of the THTLocker Ransomware available, so far, also give no information on how the Trojan might install itself, but email, torrents, and website exploit kits are all possible means of ingress.

For Windows systems that the THTLocker Ransomware is compatible with, the Alt + F4 shortcut allows the user to terminate any currently-in-focus window, including this Trojan's pop-up. However, doing so only suppresses its symptoms temporarily, and malware researchers recommend that most users reboot into Safe Mode for regaining complete control over the UI. Update your anti-malware programs, if appropriate, before scanning your PC to delete the THTLocker Ransomware. While this Trojan has no high-sophistication defenses, such as those belonging to most rootkits, only half of all brands of AV software are detecting it accurately.

Trojans such as the THTLocker Ransomware are examples of how a well-chosen few minutes of effort can translate into hours of frustration for a targeted victim. Displaying a screen-sized pop-up window is a low-effort feature for any threatening software, but is more than adequate at rendering the user helpless temporarily.

Technical Details